commit 1fc302ad23aaf3daf9e48c1515e5a5c5ec2d39b3
Author: Jean-Christophe Bauduin <jean-christophe.bauduin@mind.be>
Date:   Thu Dec 26 18:03:03 2024 +0100

    add trusted boot option + mbedtls dependency

diff --git a/boot/arm-trusted-firmware/Config.in b/boot/arm-trusted-firmware/Config.in
index c8deede9cd..8ece8b051a 100644
--- a/boot/arm-trusted-firmware/Config.in
+++ b/boot/arm-trusted-firmware/Config.in
@@ -273,4 +273,29 @@ config BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP_LEVEL
 	default "strong"  if BR2_SSP_STRONG
 	default "all"     if BR2_SSP_ALL
 
+config BR2_TARGET_ARM_TRUSTED_FIRMWARE_TRUSTED_BOARD_BOOT
+	bool "Enable Trusted Board boot"
+	help
+		Enables the trusted board boot argument for TFA.
+		more info: https://trustedfirmware-a.readthedocs.io/en/latest/design/trusted-board-boot.html
+
+endif
+
+
+if BR2_TARGET_ARM_TRUSTED_FIRMWARE_TRUSTED_BOARD_BOOT
+
+config BR2_TARGET_ARM_TRUSTED_FIRMWARE_ROT_KEY
+	string "Path to the ROT private key"
+	help
+		The ROT_KEY private key is used to sign FIP image during
+		TF-A build. It specifies a file that contains the ROT
+		private key in PEM format or a PKCS11 URI and enforces
+		public key hash generation.
+		The private key must be .pem format.
+
+config BR2_TARGET_ARM_TRUSTED_FIRMWARE_MBEDTLS_VERSION
+	string "The MbedTLS version number (ex 2.8) needed for the secure boot"
+	help
+		This option will enable the build of the specific version
+		of mbedtls required for TFA trusted boot.
 endif
diff --git a/boot/arm-trusted-firmware/arm-trusted-firmware.mk b/boot/arm-trusted-firmware/arm-trusted-firmware.mk
index 172a930b5c..149ab9d012 100644
--- a/boot/arm-trusted-firmware/arm-trusted-firmware.mk
+++ b/boot/arm-trusted-firmware/arm-trusted-firmware.mk
@@ -18,6 +18,28 @@ else
 # Handle stable official ATF versions
 ARM_TRUSTED_FIRMWARE_SITE = https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git
 ARM_TRUSTED_FIRMWARE_SITE_METHOD = git
+
+ifneq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_MBEDTLS_VERSION),)
+ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE = mbedtls-$(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_MBEDTLS_VERSION))
+
+ARM_TRUSTED_FIRMWARE_MBEDTLS_SITE = https://codeload.github.com/Mbed-TLS/mbedtls/tar.gz/refs/tags/$(ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE)
+
+define ARM_TRUSTED_FIRMWARE_MBEDTLS_EXTRACT_CMDS
+	$(WGET) -O $(DL_DIR)/$(ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE) $(ARM_TRUSTED_FIRMWARE_MBEDTLS_SITE)
+	mkdir -p $(@D)/$(ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE)
+	$(TAR) -xvf $(DL_DIR)/$(ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE) -C $(@D)/$(ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE) --strip-components=1
+	# mv $(@D)/mbedtls-$(ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE) $(@D)/$(ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE)
+endef
+
+define ARM_TRUSTED_FIRMWARE_MBEDTLS_BUILD_CMDS
+    $(MAKE) -C $(@D)/$(ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE)  \
+        CFLAGS="$(TARGET_CFLAGS)" LDFLAGS="$(TARGET_LDFLAGS)" lib
+endef
+ARM_TRUSTED_FIRMWARE_POST_EXTRACT_HOOKS += ARM_TRUSTED_FIRMWARE_MBEDTLS_EXTRACT_CMDS
+endif
+
+
+
 # The licensing of custom or from-git versions is unknown.
 # This is valid only for the latest (i.e. known) version.
 ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_LATEST_VERSION)$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_LATEST_LTS_2_10_VERSION)$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_LATEST_LTS_2_8_VERSION),y)
@@ -190,12 +212,22 @@ define ARM_TRUSTED_FIRMWARE_BL31_UBOOT_INSTALL_ELF
 endef
 endif
 
+ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_TRUSTED_BOARD_BOOT),y)
+ARM_TRUSTED_FIRMWARE_TRUSTED_BOOT_ROT_KEY=$(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_ROT_KEY))
+ARM_TRUSTED_FIRMWARE_MAKE_OPTS += \
+	ROT_KEY=$(ARM_TRUSTED_FIRMWARE_TRUSTED_BOOT_ROT_KEY) \
+	MBEDTLS_DIR=$(@D)/${ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE} \
+	GENERATE_COT=1 \
+	TRUSTED_BOARD_BOOT=1
+endif
+
 ARM_TRUSTED_FIRMWARE_MAKE_TARGETS += \
 	$(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_ADDITIONAL_TARGETS))
 
 ARM_TRUSTED_FIRMWARE_CUSTOM_DTS_PATH = $(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_DTS_PATH))
 
 define ARM_TRUSTED_FIRMWARE_BUILD_CMDS
+	# $(ARM_TRUSTED_FIRMWARE_MBEDTLS_BUILD_CMDS)
 	$(if $(ARM_TRUSTED_FIRMWARE_CUSTOM_DTS_PATH),
 		cp -f $(ARM_TRUSTED_FIRMWARE_CUSTOM_DTS_PATH) $(@D)/fdts/
 	)
@@ -213,6 +245,8 @@ define ARM_TRUSTED_FIRMWARE_INSTALL_IMAGES_CMDS
 	$(ARM_TRUSTED_FIRMWARE_BL31_UBOOT_INSTALL_ELF)
 endef
 
+
+
 # Configuration check
 ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE)$(BR_BUILDING),yy)
 

